Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates. Which secrets engine will best support this use case?

The Vault PKI (Public Key Infrastructure) secrets engine is specifically designed to dynamically generate X.509 certificates, including options for configuring their Time-To-Live (TTL). This allows organizations to issue short-lived certificates on demand, fulfilling the requirement to reduce reliance on long-lived certificates and improve security posture.

The Key/Value (KV) secrets engine version 2 can store arbitrary data and manage its versions and TTLs, but it does not have the capability to dynamically generate X.509 certificates.

Cloud KMS (Key Management Service) is used for managing cryptographic keys and performing encryption operations in cloud environments, not for issuing X.509 certificates.

The Transit secrets engine provides "cryptography as a service" for encrypting and decrypting data without exposing the raw encryption key, but it is not designed to issue X.509 certificates.